osv-scanner.toml

Rama main · réplica de lectura del repositorio original.

# Temporary informational-advisory exceptions. Both carry an expiry; known vulnerabilities
# remain blocking regardless. osv-scanner enforces these dates itself, and names an entry it
# no longer honours under `unused ignores` — which is why Sjel stopped carrying a clock of its
# own on 2026-09-02 (Q74).
#
# THIS FILE IS THE REPOSITORY SCAN'S, and CI reads it. That is why the rule above holds here
# unchanged: `tools/audit`'s second pass — over software installed outside this checkout, where
# a fix is often unreachable — has its own file, `osv-scanner-installed.toml`, which accepts
# KNOWN vulnerabilities with their reach and an end date. Widening this file to cover those
# would have widened CI too (decided 2026-10-04).
#
# Neither replacement is tracked in an issue. retired-tracker#182 used to hold both, and what
# it actually said was "review upstream-supported migration paths" with no consumer, no
# deadline of its own, and nothing to do until an ecosystem moved. The exposure, the reason
# it is accepted, and the date it stops being accepted all belong here, next to the entry
# they describe.
[[IgnoredVulns]]
id = "RUSTSEC-2025-0141"
ignoreUntil = 2027-01-01
reason = "bincode 2.0.1 is unmaintained (RustSec type INFO, no CVE, no affected function, no patched version: the team stopped development after a harassment campaign). Reach: `research/benchmarks/graph-store/Cargo.lock` only — a benchmark crate that is built by hand when someone re-measures the graph store, and that no capability links. Ends when that benchmark drops bincode or moves to a maintained fork; adopting one is the maintainer's call, not a patch here."

[[IgnoredVulns]]
id = "RUSTSEC-2024-0436"
ignoreUntil = 2027-01-01
reason = "Unmaintained paste proc-macro 1.0.15, build-time only. No affected functions, CVSS or fixed version. Reach, re-measured 2026-11-01: `apps/gpui/Cargo.lock` only, through `gpui-component 0.7.3 <- gpui-kit 0.7.3`, `metal 0.33.0 <- gpui-pre-apple`, and `pulp 0.22.3 <- exr <- image <- gpui-pre` — all macro expansion over code the build already holds, no runtime input. The root `Cargo.lock` still lists the crate, but `cargo tree -i paste` prints \"nothing to print\" for the workspace at any target: the parquet <- punctuality path this entry used to name no longer reaches it. Ends when those upstreams move to `pastey`, the successor paste names; not a patch a transitive bump here can make."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0192"
ignoreUntil = 2027-01-01
# "user-supplied" was the wrong half of the sentence, and it is corrected below rather than
# softened. Transit fetches no PDF: `src/hafas.rs` names three JSON endpoints and nothing else
# reaches the network, so nothing here arrives by a URL. The bytes arrive two ways, and only one
# of them is the operator's own file. The other is a request body on a port that, until
# 2026-09-08, answered any web page the operator had open.
reason = "Unmaintained ttf-parser 0.25.1, non-optional and runtime-reachable in two trees. Transit: via lopdf 0.42.0 <- pdf-extract 0.12.1 <- sjel-transit <- sjel-scouting (`cargo tree -i ttf-parser`, 2026-11-01). Two callers reach the parser: `transit import <file>`, where the file is the operator's own, and the raw body of `POST /api/tickets/extract`, which is whatever the caller sent. The second is why this is untrusted input, and it is more exposed than a file on disk: that route sat under CorsLayer::permissive() with no origin refusal, and it takes `Bytes` rather than a typed body, so a cross-origin simple POST reached the PDF parser with no preflight to stop it. `refuse_foreign_origins` now bounds its callers to the dashboard, the tailnet and non-browser clients. Scouting links transit for adapters/transit_fare.rs and calls no extractor, so it inherits the crate and not the reach. The app: via fontdb 0.23.0, from mermaid-rs-renderer 0.3.1 in sjel-gpui and from usvg 0.46.0 <- gpui-pre — a font database over the app's own bytes, reached when a Mermaid diagram or an SVG icon is laid out, not by a URL. No known vulnerability, no CVSS, no affected function and no fixed version: fontdb 0.23 requires ttf-parser ^0.25, so the end is fontdb or usvg moving off it, or a maintained pdf-extract alternative for transit. If either appears, take it, and keep transit's PDF fixtures and the app's diagram rendering green across the swap."

# The three below reach `apps/gpui/Cargo.lock` only through the Linux D-Bus tree (zbus, via
# AT-SPI accessibility and the secret-service keyring). None resolves for macOS or iOS. They end
# with a zbus 6 major bump upstream.
[[IgnoredVulns]]
id = "RUSTSEC-2026-0370"
ignoreUntil = 2027-01-01
reason = "Unmaintained zvariant 5.15.0, the D-Bus wire format, reached only through zbus on Linux and resolved for neither macOS nor iOS. No known vulnerability, no CVSS, no affected function and no fixed version: the crate is zbus 6.0.0's `wire` module now, so ending this needs a zbus major bump rather than a patch here. Revisit when GPUI's Linux tree moves to zbus 6."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0371"
ignoreUntil = 2027-01-01
reason = "Unmaintained zbus_names 4.3.4, the D-Bus name types, reached only through zbus on Linux and resolved for neither macOS nor iOS. Same shape and same end as RUSTSEC-2026-0370: no known vulnerability, no CVSS, no affected function, no fixed version, and the successor is zbus 6.0.0's `names` module."

[[IgnoredVulns]]
id = "RUSTSEC-2026-0372"
ignoreUntil = 2027-01-01
reason = "Unmaintained zvariant_derive 5.15.0, build-time derive macros that zvariant re-exports, reached only through zbus on Linux and resolved for neither macOS nor iOS. No CVSS, no affected function, no fixed version, and zbus 6.0.0 supplies the same macros. Same reach and same end as RUSTSEC-2026-0370."

# Both arrive through GPUI at the Zed revision apps/gpui-prototype pins (5f8a7413), so the bump is
# Zed's to make, not a transitive patch here. Checked 2026-10-11 with `cargo tree -i` in
# apps/gpui-prototype.
[[IgnoredVulns]]
id = "RUSTSEC-2026-0206"
ignoreUntil = 2026-12-01
reason = "Unmaintained rustybuzz 0.20.1, runtime, via usvg 0.46 <- gpui-pre 0.3.6 <- gpui-kit 0.6.0 <- apps/gpui-prototype. rustybuzz shapes only SVG <text> elements. The app renders gpui-kit-assets 0.6.6 icons through usvg, and none of its 1,830 SVG files has a <text> element (grep, 2026-10-15), so nothing reaches it. No affected functions, CVSS, or fixed version. The successor is harfrust. Revisit when gpui-pre moves usvg to it, or when the app renders an SVG it did not ship."

[[IgnoredVulns]]
id = "RUSTSEC-2024-0384"
ignoreUntil = 2026-12-01
reason = "Unmaintained instant 0.1.13, via gpui-base and gpui-component 0.6.6 <- gpui-kit 0.6.0 <- apps/gpui-prototype, and notify-types. An informational advisory: no affected functions, CVSS, or fixed version. The successor is web-time. Revisit when gpui-kit drops it or the prototype bumps gpui-kit."

[[IgnoredVulns]]
id = "RUSTSEC-2025-0134"
ignoreUntil = 2026-12-01
reason = "Unmaintained rustls-pemfile 2.2.0, via gpui-pre-reqwest 0.12.15 <- gpui-pre-reqwest-client 0.3.6 <- gpui-kit 0.6.0 <- apps/gpui-prototype. An informational advisory: no affected functions, CVSS, or fixed version, and its parsing lives on in rustls-pki-types. The prototype talks only to loopback sjel-status over plain http. Revisit at the step 0 bump."